release: prepare v0.15.1 beta-21 fix-forward - #543

What changed

• prepare Registry Stack v0.15.1 as beta-21 from protected main
• preserve v0.15.0 as immutable failed-train evidence and record that publication stopped before any public write
• strip exactly Git's one for-each-ref record separator before parsing the annotated-tag candidate binding
• remove verified candidate ZIP transports from the finalizer inventory
• bump release surfaces, starter provenance, docs, OpenAPI versions, lockfiles, changelogs, and release notes to 0.15.1
• add a draft v0.15.1 docset and draft release manifest, to be pinned to this PR's exact merge commit in the candidate-finalization PR

Why

The v0.15.0 candidate run passed, but its tag-triggered workflow failed before publication because git for-each-ref --format='%(contents)' adds a record separator after the tag contents. The strict candidate-binding parser correctly rejected the resulting second trailing newline. The immutable v0.15.0 tag is not reused or moved, so this release fixes forward as v0.15.1.

The product behavior is unchanged from the verified v0.15.0 candidate.

Validation

• 590 release-script tests passed, 1 skipped
• 240 docs tests passed, 1 skipped
• Registryctl embedded starter provenance integrity passed for all six starters/fixtures
• locked Cargo metadata passed for the workspace and all three fuzz workspaces
• archive lock check passed for 16 archives
• release gate inventory passed for 168 gates
• beta-21 manifest and 13 versioned docsets validated
• registry-release prepare --version 0.15.1 --release-id beta-21 returned ready
• git diff --check passed

Hosted publication and the Solmara adopter repin remain explicitly held until immutable v0.15.1 digests exist.